Scope and operating boundary
The owner contact is mani@rellooma.com. Ask for an agreed secure channel before sharing sensitive technical evidence.
Security reporting
Start with a non-sensitive summary of the issue you observed in Rellooma. Do not send customer data or credentials.
The owner contact is mani@rellooma.com. Ask for an agreed secure channel before sharing sensitive technical evidence.
This draft does not authorize testing, offer a bounty or promise a response deadline. Mailbox delivery and the handling process still require owner verification.
A clear report can help identify the affected service without exposing another person's data.
Draft 0.1 · Reviewed 6 October 2026 · Not an effective testing policy
English is the draft source. Turkish and Persian versions are informational translations pending review.
Start a non-sensitive security report: mani@rellooma.com
Identify the affected Rellooma URL or feature, the time observed, expected and actual behavior, and minimal steps to explain the issue. Redact identifiers and use synthetic examples. Do not attach passwords, tokens, private messages or customer records.
Stop if you encounter someone else's data. Do not access additional records, alter data, interrupt services, run denial-of-service tests, phish users or target third-party providers. This page gives no permission to test any system; obtain explicit authorization first.
Ordinary email is not a verified secure evidence channel here. Send only a non-sensitive initial summary to the owner contact, then agree a secure transfer method before sharing restricted technical details. Do not post exploitable details publicly while coordination is pending.
The mailbox and triage process await owner verification. No acknowledgement deadline, remediation deadline, payment, safe-harbor protection or legal immunity is promised. A report is not proof of receipt or resolution. Account support and data-rights requests use their separate routes.